WordPress Patches 11 Vulnerabilities, Including XSS and RCE Flaws

Key Takeaways

• WordPress has released version 7.1.1, a critical security and maintenance update.
• The update addresses 11 vulnerabilities, including multiple cross-site scripting (XSS) flaws, an authenticated path traversal vulnerability, and several authorization bypass issues.
• These vulnerabilities could enable unauthorized content injection, information disclosure, and potential remote code execution in specific scenarios.
• All WordPress site owners and administrators are strongly advised to update immediately to mitigate risks.

WordPress has rolled out version 7.1.1, a significant security and maintenance release addressing a total of 11 vulnerabilities within the widely adopted content management system. This update is crucial for safeguarding websites against various attack vectors, including cross-site scripting (XSS), authorization bypasses, information disclosure, and path traversal exploits.

Website administrators and owners are strongly encouraged to implement this update without delay to fortify their sites against potential cyber threats. In addition to the security patches, WordPress 7.1.1 incorporates 17 bug fixes for the WordPress Core and an additional 19 fixes for the Block Editor. Websites configured for automatic background updates should receive the patch automatically. For those managing updates manually, the release can be installed via the WordPress Dashboard by navigating to “Updates” and selecting “Update Now.”

Critical Vulnerabilities Addressed

Among the most pressing issues resolved are multiple stored cross-site scripting (XSS) vulnerabilities. One notable flaw resides within the wpautop() function. This vulnerability could permit an unauthenticated attacker to inject malicious scripts into website content, provided the comment is approved. Should such a malicious comment be approved and subsequently viewed by another user, the embedded code could execute within that user’s browser, posing a significant risk.

Another stored XSS vulnerability was identified affecting certain themes designed to support custom headers. WordPress also fixed an HTML API vulnerability impacting the set_modifiable_text() function. This particular flaw could allow an attacker to escape a comment context through specially crafted abrupt-closing sequences, potentially leading to further compromise.

The update also rectifies several flaws that could lead to unauthorized actions or the exposure of sensitive information. One vulnerability involved a specially crafted URL that could automatically install and preview an inactive theme from WordPress.org. While this issue does not inherently enable arbitrary theme installation from an attacker-controlled source, it could be exploited to alter site behavior or expose administrators to unintended theme previews.

An authenticated path traversal vulnerability in the WP REST Templates Controller, reported by Anthropic, has also been resolved. Path traversal flaws can potentially allow authenticated users to access or manipulate files and resources outside their intended directory paths, depending on the specific component and deployment configuration.

Further fixes prevent Contributor-level users from overwriting arbitrary posts. WordPress also patched missing authorization checks that could reveal draft or pending post slugs to contributors and expose the title of a private parent post via attachment metadata.

The XML-RPC interface received a crucial security patch after researchers discovered it could be used to publish customize_changeset posts while bypassing checks for the edit_css capability. Historically, XML-RPC has been a frequent target for WordPress attackers due to its exposure of remote publishing and administrative functionalities.

Additionally, WordPress addressed an issue where any authenticated user could reparent comments, including internal notes. In multi-user publishing environments, this could disrupt moderation workflows, compromise comment organization, and affect the integrity of editorial records.

The vulnerabilities were responsibly disclosed by a team of security researchers, including Rafie Muhammad, Jeremy Felt, Paulos Yibelo, pwn.ai, Jesse McNeil, Anthropic, Ben Bidner, HDWSec, hermanhms, and viridis.

WordPress confirmed that these security fixes are being backported to supported security branches, currently extending to versions through 4.7. However, only the latest WordPress release receives active support, making version 7.1.1 the recommended deployment for all production websites.

What You Should Do

• Update Immediately: Apply WordPress 7.1.1 without delay. If automatic updates are enabled, verify the patch has been installed. For manual updates, navigate to “Dashboard” > “Updates” and click “Update Now.”
• Backup Your Site: Before initiating any major updates, always perform a full backup of your website files and database.
• Monitor for Anomalies: After updating, monitor your website for any unusual behavior or error messages.
• Review User Roles: Regularly audit user roles and permissions to ensure they are appropriate and adhere to the principle of least privilege.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.